3.4.0

The platform release: resource isolation, backup and security built on the open-source stack the panel already runs, all of it in the Rust CLI (hitechcloud-rustcli, required from this version).

Resource & Isolation platform

HiTech Resource Engine (hitechcloudcli native-limits): plan limits on each account's systemd slice as before, plus per-account overrides (override <acct> cpu= ram= swap= nproc= io_read= io_write= iops= burst=), live usage (CPU %, memory, swap, IO bytes/ops, tasks, entry processes, TCP connections, open files - usage [--json]), history (1m/5m/15m averages, peaks, violation counter, abuse score) and a policy timer every minute: a violation is logged and sent to native-event, a repeat offender is throttled to half its CPU for ten minutes, and an account whose abuse score keeps climbing is suspended only when RESOURCE_POLICY_SUSPEND=on. Works on cgroup v1 (AlmaLinux 8) and v2.
Account jail in Rust (hitechcloud-jail): the same private filesystem and PID namespace, now with a clean environment (the shell no longer inherits root's), hidepid=invisible on /proc, ambient capabilities cleared, the shell scoped into the account's slice (its CPU/RAM limits apply to the terminal too), proper exit codes and no leftover jail directories. native-jail harden sets the SecureLinks and ptrace sysctls; native-jail status reports them.
Cron jobs run inside the jail: every account gets the sudoers rule that lets it open its own jail; the panel wraps each managed job in it.
A php-fpm master per account (hitechcloudcli native-fpm enable): every site's PHP workers run inside their account's slice, so the plan limits and the policy engine cover them - native-limits verify reports all processes inside the slice. Fresh installs start this way; updated servers opt in with one command. The account's Varnish and memcached instances and its Node/Python/Ruby/Java applications join the slice as well.
PHP Selector per account: the version an account selects on PHP > Default version is its own (it used to change the server-wide default for everybody), and it is what its shell, cron jobs and new sites get. native-phpselector show|set|resolve|binary.
Runtime security (HardenedPHP-like): native-phpselector security and a Runtime security table on the PHP page - support status and end-of-life date per installed version, patch level, whether the build is the mirror's patched legacy package, a 0-100 score; native-phpselector audit <acct> for one account's sites.
Runtime Selector (hitechcloudcli native-runtime): Node.js versions from nodejs.org (SHA256-verified), Python, Java and Ruby from the distribution, side by side under /opt/hitechcloud/runtimes; the application installer offers every installed version and runs the app with the one chosen.
DB Governor (native-dbgovernor, 3.3.x) keeps its one-minute timer; the update enables it where a database is present.

Backup platform

Repository backups with restic (hitechcloudcli native-backup): BACKUP_ENGINE=restic - selectable on the Backup schedule page - keeps one deduplicated, encrypted repository per account (local root-owned, SFTP or S3 from the account's destination settings); every run is a snapshot, retention is forget --prune, --verify and a weekly self-check read the data back, restore points appear beside tar chains and restore through the same page. Tar chains remain the default.
Immutable and DR backups: BACKUP_IMMUTABLE=on for an append-only remote (S3 Object Lock, rest-server --append-only) - nothing is pruned from the server, so ransomware on the machine cannot take the backups with it; DR_REPOSITORY replicates every snapshot to a second repository (native-backup replicate, --dr on snapshots/check/restore).
Fixed: user-backupset hung forever on an account without a PostgreSQL role (psql waiting for a password on the caller's stdin); email-quotas never chowned a single mail directory.

Security platform

WAF risk bands: on top of the rule score, per server and per site - RISK_MONITOR (a served request is still logged), RISK_BLOCK (a challenge becomes a block), RISK_BAN (the address is banned) - and a progressive ban: BAN_AFTER blocks inside BAN_WINDOW ban the address for BAN_SECONDS (10 in 5 minutes for 10 minutes by default). Banned addresses are refused before rate limiting and the rules. hitechcloudcli native-waf risk <domain> shows and sets the ladder.
Security Center on HiTechAdmin > Website Firewall: the last 24 hours across every protected site (events, blocked, challenged, bans, rate-limited, monitored), top addresses / rules / attack tags / paths, and the addresses banned right now with Lift ban. native-waf stats, native-waf bans, native-waf unban.
Fixed: the firewall answered 502 for every request to a site served by Caddy, Lighttpd, H2O or Cherokee (its origin map knew three engines).

Cache

Cache tags: the application's Cache-Tag / X-Cache-Tags / xkey / Surrogate-Key headers are kept on cached objects, and hitechcloudcli native-varnish purge <domain> --tag <tag> drops exactly the pages carrying that tag (a product, a post) instead of the whole site. native-varnish warm <domain> fetches the sitemap's pages so the cache holds them before visitors ask.

CLI

Twenty-seven commands now run in Rust (hitechcloud-rustcli ported), including gitdeploy-list, gitdeploy-key, websites-all, websites-user, domains-all, php-domain, user-loginlog, email-quotas, each byte-identical to the script it replaces. The updater refreshes hitechcloud-rustcli with the panel binaries.
version/3.4.0/UPDATE.sh migrates existing servers: jail sudoers for every account, isolation sysctls, templates, Varnish VCLs, plan limits re-applied, the Resource Engine and DB Governor timers, the firewall restarted, restic installed; per-account PHP-FPM is left for the administrator (hitechcloudcli native-fpm enable, or HITECHCLOUD_UPDATE_FPM_PER_ACCOUNT=1 at update time).